Dec. 5, 2018 – The recent data breach of hotel chain Marriot, which compromised the personal data of up to 500 million guests, is just another example of the risks that cyber criminals pose to businesses, as well law firms that hold sensitive data.

Cyber insurance is one way to protect law firms from data breaches. But cyber insurance is just one component of the overall cyber security strategy, says Tom Widman, president and CEO of Identity Fraud, Inc., based in San Francisco.

“We want folks to do risk management,” said Widman, who spoke on cyber security and insurance at the State Bar of Wisconsin’s 2018 Wisconsin Solo and Small Firm Conference (WSSFC). “You can get hacked, you can lose your data, your computers can be lost or stolen, and you can experience business interruption,” he said.

Widman says cyber insurance looks at these different avenues, so-called attack-vectors, of how cyber criminals get in to private data, and insures the exposures.

“If you lose data, you might get sued,” Widman says. “You might also have some regulatory fines and penalties. You start to look at what’s called first-party exposures.”

Cyber extortion, such as crypto ransomware is an example. “Lots of law firms are affected by that and so there’s cyber extortion coverage that comes in a lot of these policies that pays the ransom and pays the experts to come in and figure it out.”

Policies may include “data incident response,” Widman noted. “One of the highest valued components of the policy is, when something happens, who do you call?” Having 24/7 access to experts is important since many people don’t know what happened. “Many policies, including ours, have what’s called incident response on-demand.”

Amidst the chaos surrounding cyber threats, cyber insurance just reduces the chaos, Widman said. “We want people to have really good risk management,” Widman said, “and use cyber insurance as that final layer of security when all else fails.”